1 NASA OSMA SAS02 Software Fault Tree Analysis Dolores R. Wallace SRS Information Services Software Assurance Technology Center Dr. Massood Townidnejad Embry-Riddle University NASA OSMA SAS '02

2 NASA OSMA SAS02 The Premise FTA applies to software (SFTA) 1 SFTA uses same tools as FTA SFTA can apply FTA algorithms computing risk based on probability 1 Several researchers have explored SFTA to some extent, e.g., Leveson, Lutz, Dugan, Heimdahl

3 NASA OSMA SAS02 Tasks Understand the methodology, including symbology Develop tool evaluation criteria Identify commercial tools Get demonstration copies Apply tools to software

4 NASA OSMA SAS02 FTA Methodology Hierarchical, graphical representation of events Notation to represent Boolean expression recording relationships between states/ events Qualitative: ID of design weaknesses,e.g., single point of failure and safety critical failure combinations Quantitative: event’s probability of occurrence to identify paths most likely to occur Starting point (top of tree): system failure or hazard Backward progression id’ing parallel and sequence combinations of events causing top event to occur

5 NASA OSMA SAS02 Probability Issue Hardware –Large collections of historic data –Classification of failure types –Degradation Software –Limited availability of software failure data –Classification of cause more relevant –Degradation not same for software –Probability values not available, though subject of research efforts

6 NASA OSMA SAS02 FTA Symbology BASIC CONDITIONING UNDEVELOPED EXTERNAL INTERMEDIATE EVENTS GATES TRANSFERS OUT IN AND OR EXCLUSIVE OR PRIORITY AND INHIBIT

7 NASA OSMA SAS02 Tool Evaluation Criteria Categories User Interface Functionality Output SFTA Model Security Operational Issues Adaptability *** Cost of Tool (consider functionality not usable by SFTA) Return on Investment

8 NASA OSMA SAS02 Commercial Tools Approximately 33 Most embody two or more analyses (e.g., FMEA) All compute risk with algorithms applying values of probability of failure Many claim adaptability for SFTA Two claimed specific use for SFTA, but … Lack of specific SFTA tools caused our redirection!

9 NASA OSMA SAS02 New Focus: Life Cycle Approach Requirements –Identify weaknesses and modify, eliminate them –Identify those with direct impact on safety of system Design –Apply to design, smaller than related code –Identify components/modules, subcomponents with direct impact on safety of system Code –Apply only to those subcomponents already identified as having direct impact on safety of system

10 NASA OSMA SAS02 Application of SFTA to Software Design The Challenge –Focus SFTA on OODs –Develop a relationship between OOD charts and diagrams to symbology of FTA Initial Issues –Attempt to fit activity diagram to general template –Recognize loops as a feature of activity diagram –Allow for concurrency found in many real-time systems –Applied commercial tool- identified probable cause of failure successfully in each case Next Steps –Generate fault trees directly from several activity diagrams

11 NASA OSMA SAS02 Activity Diagram Deliver drink Choose drink Show drink menu Ch eck enough money is inserted Ins ert coins into machine Drink not available Drink available

12 NASA OSMA SAS02 Software Fault Tree

13 NASA OSMA SAS02 Resulting Fault Tree Analysis

14 NASA OSMA SAS02 FUTURE Identify the general features of activity, state, and sequence diagrams as related to FTA symbology Apply this approach to real, larger designs Have commercial tool vendor work with us to build the interface between these OOD types and the FTA symbology Hoped for result: practical means of applying FTA to software across the life cycle!